SQL Injection Vulnerability in Risesoft Y9 WorkFlow-Engine
CVE-2026-102616

6.9MEDIUM

Key Information:

Vendor: Risesoft-y9
Status: Workflow-engine
Vendor: CVE Published:; 29 September 2026

🔔 Create Risesoft-y9 Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102616?

A vulnerability has been identified in the Risesoft Y9 WorkFlow-Engine, specifically in the function getByIdAndYear within the CustomHistoricProcessServiceImpl.java file of the OAuth2 Resource Filter. This flaw allows malicious actors to manipulate the year or processInstanceId arguments, resulting in SQL injection vulnerabilities. Such vulnerabilities enable unauthorized remote exploitation, threatening the integrity of the application’s database. Notably, the vulnerability can be exploited through multiple points, enhancing its severity. Despite early disclosure attempts, the vendor failed to respond to the report.

Affected Version(s)

WorkFlow-Engine 9.6.0

WorkFlow-Engine 9.6.1

WorkFlow-Engine 9.6.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102616 - Proof of Concept